Chrome 156 and Firefox 159 patch more than 200 flaws
Original title: Chrome and Firefox Updates Patch Over 200 Vulnerabilities
CVE-2026-118306 can run arbitrary code outside Chrome's sandbox from a crafted HTML page; no in-the-wild exploitation is mentioned.
Google and Mozilla released browser updates fixing more than 200 vulnerabilities. Chrome 156 patches 52 defects, including four critical issues, and Firefox 159 patches 167, including 108 high-severity flaws, mostly use-after-free bugs. Mozilla also shipped Thunderbird 159 and 153.6 and Firefox ESR 153.6 and 115.44 with many of the same fixes. Neither vendor says any of the bugs are being exploited.
Unconfirmed: Neither Google nor Mozilla says whether any of these bugs have been exploited.
- Chrome's critical bugs are in FileSystem, FileAPI, Skia, and Layout.
- Chrome is rolling out as 156.0.8078.73/.74 on Windows and macOS and 156.0.8078.73 on Linux.
- Google has not set bug-bounty amounts, and 39 reports will receive no reward.
- Firefox fixes also cover sandbox escape, privilege escalation, and same-origin policy bypass.
Impact: Arbitrary code execution outside the Chrome sandbox
| Product | Affected | Fixed in |
|---|---|---|
| Google Chrome | — | 156.0.8078.73/.74 (Windows and macOS); 156.0.8078.73 (Linux) |
| Mozilla Firefox | — | 159 |
| Mozilla Firefox ESR | — | 153.6 and 115.44 |
| Mozilla Thunderbird | — | 159 and 153.6 |
- 1.Update Chrome, Firefox, Firefox ESR, and Thunderbird to the released versions.
- CVEs
- CVE-2026-118306
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-118306 | Critical sandbox-escape memory corruption in Google Chrome FileSystem | 9.6 | — |
From the original article
1 min read at securityweek.com
The Chrome 156 update fixes 52 bugs, while Firefox 159 was rolled out with 167 security patches. The post Chrome and Firefox Updates Patch Over 200 Vulnerabilities appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.